drupal 10.3.9

This is a security release of the Drupal 10 series.

This release fixes security vulnerabilities. Sites are urged to update immediately after reading the notes below and the security announcements:

• Drupal core - Moderately critical - Cross-Site Scripting - SA-CORE-2024-003
• Drupal core - Moderately critical - Access Bypass - SA-CORE-2024-004
• Drupal core - Less critical - Gadget chain - SA-CORE-2024-006
• Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007
• Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008

No other fixes are included.

Which release do I choose? Security coverage information

• Drupal 10.3.x will receive security coverage until June 2025 when Drupal 10.5.0 is released.
• Sites on 10.2.x should update immediately to Drupal 10.2.11, but plan to update to Drupal 10.3, 10.4, or 11 by December 2024.
• Drupal 8 and 9 are end-of-life and do not receive security coverage.

Important update information

As part of the protection against a potential vulnerability, additional checks have been added to some of Drupal core's database related code. If you use a third party database driver that makes use of the Drupal\Core\Database\StatementPrefetchclass, you may need to allow-list the driver by adding it to settings.php.

Drupal Core's own database drivers (and the contributed Drupal driver for SQL Server and SQL Azure (sqlsrv)) do not require additional configuration. The contributed Oracle driver is allow-listed by default.

Example for settings.php:

$settings['database_statement_prefetch_valid_db_drivers'] = ['mydbdriver'];